Install, link, and update certificates

Link certificates

Many server certificates are signed by multiple hierarchical Certificate Authorities (CAs). This means that the certificates form a chain like the following:

Sometimes, the Intermediate CA is split into a primary and secondary intermediate CA. Then the certificates form a chain like the following:

Client machines usually contain the root CA certificate in their local certificate store, but not the intermediate CA certificate(s). The ADC appliance must send the intermediate CA certificate(s) to the clients.

**Note:** The appliance must not send the root CA certificate to the client. The Public Key Infrastructure (PKI) trust relationship model requires root CA certificates to be installed on clients through an out-of-band method (For example, the certificates are included with the operating system or web browser). The client ignores a root CA certificate sent by the appliance.

If an intermediate CA that is not recognized by standard web browsers as a trusted CA, issues the server certificate, the CA certificate(s) must be sent to the client with the server’s own certificate. Otherwise, the browser terminates the SSL session because it fails to authenticate the server certificate.

Add and link a certificate set

Note: This feature is not supported on the Citrix ADC FIPS platform and in a cluster setup.

Instead of adding and linking individual certificates, you can now group a server certificate and up to nine intermediate certificates in a single file. You can specify the file’s name when adding a certificate-key pair. Before you do so, make sure that the following prerequisites are met.

The certificates in the file are in the following order:

Server certificate (should be the first certificate in the file)

Optionally, a server key

Intermediate certificate 1 (ic1)

Intermediate certificate 2 (ic2)

Intermediate certificate 3 (ic3), and so on
Note: Intermediate certificate files are created for each intermediate certificate with the name “<certificatebundlename>.pem_ic<
n>” where n is between 1 and 9. For example, bundle.pem_ic1, where bundle is the name of the certificate set and ic1 is the first intermediate certificate in the set.

Bundle option is selected.

No more than nine intermediate certificates are present in the file.

The file is parsed and the server certificate, intermediate certificates, and server key (if present) are identified. First, the server certificate and key are added. Then, the intermediate certificates are added, in the order in which they were added to the file, and linked accordingly.

An error is reported if any of the following conditions exist:

A certificate file for one of the intermediate certificates exists on the appliance.

The key is placed before the server certificate in the file.

An intermediate certificate is placed before the server certificate.

Intermediate certificates are not in placed in the file in the same order as they are created.

No certificates are present in the file.

A certificate is not in the proper PEM format.

The number of intermediate certificates in the file exceeds nine.

Add a certificate set by using the CLI

At the command prompt, type the following commands to create a certificate set and verify the configuration:

Add a certificate set by using the GUI

In the Install Certificate dialog box, type the details, such as the certificate and key file name, and then select Certificate Bundle.

Click Install, and then click Close.

Create a chain of certificates

Instead of using a set of certificates (a single file), you can create a chain of certificates. The chain links the server certificate to its issuer (the intermediate CA). For this approach to work, the intermediate CA certificate file must already be installed on the Citrix ADC appliance, and the client application must trust one of the certificates in the chain. For example, link Cert-Intermediate-A to Cert-Intermediate-B, where Cert-Intermediate-B is linked to Cert-Intermediate-C, which is a certificate trusted by the client application.

Note: The appliance supports sending a maximum of 10 certificates in the chain of certificates sent to the client (one server certificate and nine CA certificates).

Create a certificate chain by using the CLI

At the command prompt, type the following commands to create a certificate chain and verify the configuration. (Repeat the first command for each new link in the chain.)

Create a certificate chain by using the GUI

Navigate to Traffic Management > SSL > Certificates.

Select a server certificate, and in the Action list, select Link, and specify a CA certificate name.

Update an existing server certificate

To avoid downtime when replacing a certificate-key pair, you can update an existing certificate. If you want to replace a certificate with a certificate that was issued to a different domain, you must disable domain checks before updating the certificate.

To receive notifications about certificates due to expire, you can enable the expiry monitor.

When you remove or unbind a certificate from a configured SSL virtual server, or an SSL service, the virtual server or service becomes inactive until a new valid certificate is bound to it. To avoid downtime, you can use the update feature to replace a certificate-key pair that is bound to an SSL virtual server or an SSL service, without first unbinding the existing certificate.

Overview diagram of how to update an SSL certificate on the Citrix ADC appliance.

Update an existing certificate-key pair by using the CLI

At the command prompt, type the following commands to update an existing certificate-key pair and verify the configuration:

Right-click the updated certificate, and click Cert Links, to see if it is linked to an intermediate certificate.

If the certificate is not linked, then right-click the updated certificate, and click Link to link it to an intermediate certificate. If you don’t see an option to link, then you must first have to install a new intermediate certificate on the appliance under the CA Certificates node.

Update an existing CA certificate

The steps to update an existing CA certificate are the same as updating an existing server certificate. The only difference is that you do not need a key in the case of CA certificates.

Disable domain checks

When an SSL certificate is replaced on the appliance, the domain name mentioned on the new certificate should match the domain name of the certificate being replaced. For example, if you have a certificate issued to abc.com, and you are updating it with a certificate issued to def.com, the certificate update fails.

However, if you want the server that has been hosting a particular domain to now host a new domain, you can disable the domain check before updating its certificate.

Disable the domain check for a certificate by using the CLI

At the command prompt, type the following commands to disable the domain check and verify the configuration:

Disable the domain check for a certificate by using the GUI

Enable the expiry monitor

An SSL certificate is valid for a specific period. A typical deployment includes multiple virtual servers that process SSL transactions, and the certificates bound to them can expire at different times. An expiry monitor configured on the appliance creates entries in the appliance’s syslog and ns audit logs when a certificate configured is due to expire.

If you want to create SNMP alerts for certificate expiration, you must configure them separately.

Enable an expiry monitor for a certificate by using the CLI

At the command prompt, type the following commands to enable an expiry monitor for a certificate and verify the configuration:

Enable an expiry monitor for a certificate by using the GUI

Select Notify When Expires, and optionally specify a notification period.

Update an intermediate certificate without breaking the links

You can now update an intermediate certificate without breaking any existing links. You can do this if the optional ‘AuthorityKeyIdentifier’ extension, in the linked certificate issued by the certificate to be replaced, does not contain an authority certificate serial number (‘authorityCertSerialNumber’) field. If the ‘AuthorityKeyIdentifier’ extension contains a serial number field, then the certificate serial numbers of the old and new certificate must be the same. You can update any number of certificates in the link, one at a time, if the preceding condition is met. Previously, the links broke if an intermediate certificate was updated.

For example, there are four certificates: CertA, CertB, CertC, and CertD. CertA is the issuer for CertB, CertB is the issuer for CertC, and so on. To replace intermediate certificate CertB with CertB_new, without breaking the link, the following condition must be met:

The certificate serial number of CertB should match the certificate serial number of CertB_new if both of the following conditions are met:

The AuthorityKeyIdentifier extension is present in CertC.

This extension contains a serial number field.

If the common name in a certificate changes, while updating the certificate specify nodomaincheck.

In the preceding example, to change “www.example.com” in CertD to “*.example.com”, select the ‘No Domain Check” parameter.

Display a certificate chain

A certificate contains the name of the issuing authority and the subject to whom the certificate is issued. To validate a certificate, you must look at the issuer of that certificate and confirm if you trust the issuer. If you do not trust the issuer, you must see who issued the issuer certificate. Go up the chain until you reach the root CA certificate or an issuer that you trust.

As part of the SSL handshake, when a client requests a certificate, the appliance presents a certificate and the chain of issuer certificates that are present on the appliance. An administrator can view the certificate chain for the certificates present on the appliance and install any missing certificates.

View the certificate chain for the certificates present on the appliance by using the CLI

At the command prompt, type:

show ssl certchain <cert_name>

Examples

There are 3 certificates: c1, c2, and c3. Certificate c1 is signed by c2, c2 is signed by c3, and c3 is the root CA certificate. The following examples illustrate the output of the
show ssl certchain c1 command in different scenarios.

Scenario 1:

Certificate c2 is linked to c1, and c3 is linked to c2.

Certificate c3 is a root CA certificate.

If you run the following command, the certificate links up to the root CA certificate are displayed.

If you run the following command, information about the certificate linked to c1 is displayed and you are prompted to add a certificate with the subject name specified in c2. In this case, the user is asked to add the root CA certificate c3.

The official version of this content is in English. Some of the Citrix documentation content is machine translated for your convenience only. Citrix has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Citrix product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Citrix, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Citrix will not be held responsible for any damage or issues that may arise from using machine-translated content.

THIS SERVICE MAY CONTAIN TRANSLATIONS POWERED BY GOOGLE. GOOGLE DISCLAIMS ALL WARRANTIES RELATED TO THE TRANSLATIONS, EXPRESS OR IMPLIED, INCLUDING ANY WARRANTIES OF ACCURACY, RELIABILITY, AND ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.